Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866917944818139136 |
|---|---|
| author | Landauer, Max Alton, Leonhard Lindorfer, Martina Skopik, Florian Wurzenberger, Markus Hotwagner, Wolfgang |
| author_facet | Landauer, Max Alton, Leonhard Lindorfer, Martina Skopik, Florian Wurzenberger, Markus Hotwagner, Wolfgang |
| contents | Kernel rootkits provide adversaries with permanent high-privileged access to compromised systems and are often a key element of sophisticated attack chains. At the same time, they enable stealthy operation and are thus difficult to detect. Thereby, they inject code into kernel functions to appear invisible to users, for example, by manipulating file enumerations. Existing detection approaches are insufficient, because they rely on signatures that are unable to detect novel rootkits or require domain knowledge about the rootkits to be detected. To overcome this challenge, our approach leverages the fact that runtimes of kernel functions targeted by rootkits increase when additional code is executed. The framework outlined in this paper injects probes into the kernel to measure time stamps of functions within relevant system calls, computes distributions of function execution times, and uses statistical tests to detect time shifts. The evaluation of our open-source implementation on publicly available data sets indicates high detection accuracy with an F1 score of 98.7\% across five scenarios with varying system states. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2503_02402 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity Landauer, Max Alton, Leonhard Lindorfer, Martina Skopik, Florian Wurzenberger, Markus Hotwagner, Wolfgang Cryptography and Security Kernel rootkits provide adversaries with permanent high-privileged access to compromised systems and are often a key element of sophisticated attack chains. At the same time, they enable stealthy operation and are thus difficult to detect. Thereby, they inject code into kernel functions to appear invisible to users, for example, by manipulating file enumerations. Existing detection approaches are insufficient, because they rely on signatures that are unable to detect novel rootkits or require domain knowledge about the rootkits to be detected. To overcome this challenge, our approach leverages the fact that runtimes of kernel functions targeted by rootkits increase when additional code is executed. The framework outlined in this paper injects probes into the kernel to measure time stamps of functions within relevant system calls, computes distributions of function execution times, and uses statistical tests to detect time shifts. The evaluation of our open-source implementation on publicly available data sets indicates high detection accuracy with an F1 score of 98.7\% across five scenarios with varying system states. |
| title | Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2503.02402 |